CDFI CDFI Network Forensics & Traffic Analysis

Question 1

Which protocol is most commonly analyzed in network forensics to reconstruct TCP session data?

Accepted Answer

TCP

Answer

UDP

Answer

ICMP

Answer

ARP

Question 2

What tool is widely used by CDFI investigators to capture and analyze live network traffic packets?

Accepted Answer

Wireshark

Answer

FTK Imager

Answer

Autopsy

Answer

EnCase

Question 3

In network forensics, what does a 'pcap' file contain?

Accepted Answer

Raw captured network packets

Answer

Encrypted disk images

Answer

Registry hive data

Answer

Browser history records

Question 4

Which NetFlow data element is most useful for identifying the volume of data transferred between two hosts?

Accepted Answer

Byte count

Answer

Source port

Answer

Protocol type

Answer

TTL value

Question 5

What is the primary purpose of analyzing DNS logs during a digital forensic investigation?

Accepted Answer

Identifying C2 communication and domain lookups

Answer

Recovering deleted files

Answer

Decrypting SSL traffic

Answer

Mapping physical network topology

Question 6

During a network forensic investigation, a 'SYN flood' pattern in captured traffic most likely indicates which type of activity?

Accepted Answer

A denial-of-service attack

Answer

Normal web browsing

Answer

A successful file transfer

Answer

ARP cache poisoning